SearcharxivSearch

arXiv subjects

Yuanyu Zhang

Publications and source records attributed to Yuanyu Zhang.

At least 19 recordsLinked to original sources

C$^2$T-OpenMax: A Novel Open-Set WiFi RF Fingerprinting Method via Center Constrained Learning and Confidence-Guided Tail Modeling

Radio frequency fingerprinting (RFF) enables device authentication from transmitter-specific hardware imperfections, but practical deployment requires cross-environment open-set recognition. Data augmentation improves environmental generalization, yet may yield dispersed, low-confidence known-class representations that distort the class statistics used by OpenMax. To address this problem, we propose C$^2$T-OpenMax, an enhanced OpenMax framework combining center-constrained learning with confidence-guided tail modeling. The former improves intra-class compactness, making class-wise representations more suitable for distance-based modeling. The latter retains only correctly classified, high-confidence logits for mean activation vector estimation and Weibull fitting, reducing bias from ambiguous boundary samples. Together, the two modules refine representation geometry and OpenMax construction while preserving augmentation benefits. Experiments on a public WiFi CSI dataset show that C$^2$T-OpenMax achieves the highest open-set accuracy in seven of eight location groups and outperforms all baselines in area under the receiver operating characteristic curve (AUROC) and open-set classification rate (OSCR) across every tested openness level. Under the largest-openness setting, it improves accuracy by 12.31%, AUROC by 0.0887, and OSCR by 0.0856 over the augmented OpenMax baseline.

cs.CR

MARL-Based Sequential RIS Auctions: A Physical-Layer Security Analysis

Reconfigurable intelligent surfaces (RISs) hold great potential to enhance coverage, spectral efficiency, and communication security by intelligently configuring their reflecting elements. When owned by a neutral RIS operator, these elements can be offered as resources for which legitimate receivers and eavesdroppers compete. This paper investigates such competition and evaluates its impact on the physical-layer security performance of legitimate receivers. To model the competition, we develop a sequential RIS auction (SRA) framework, in which a bundle of RIS elements is auctioned in each round through a first-price sealed-bid mechanism, with each bidder submitting its bid based on the achievable rate gain and remaining budget. We then formulate the sequential bidding process as a Markov game by specifying its states, actions, rewards, and state transitions. To solve the game, we propose a multi-bidder deep deterministic policy gradient (MADDPG)-based multi-bidder reinforcement learning (MARL) approach under centralized training and decentralized execution (CTDE), enabling legitimate receivers and eavesdroppers to learn bidding strategies that maximize their long-term economic surplus. Numerical results show that, under the considered eavesdropper bidding strategies, the RL-based strategy enables legitimate receivers to achieve the highest secrecy rate per unit cost, outperforming random and fixed strategies and approaching the ideal physical-layer upper bound.

cs.CR

IriSig-Spoof: A Real-World Benchmark for Time-Robust Satellite RF Fingerprinting and Spoofing Detection

Low Earth orbit (LEO) satellite Internet is becoming critical communications infrastructure, yet its open wireless links remain vulnerable to satellite impersonation and signal spoofing. Radio frequency fingerprinting (RFF) offers a potential defense by exploiting transmitter-specific hardware imperfections manifested in received signals. However, the reliability of existing satellite RFF methods remains difficult to assess because no unified dataset and benchmark support temporal, open-set, and cross-scenario evaluation. To address this gap, we introduce IriSig-Spoof, a real-world Iridium dataset comprising 5.17 million messages collected from 66 satellites over 32 days, together with software-defined radio (SDR)-generated spoofing signals from indoor and outdoor settings. We further establish three benchmark tasks: temporal robustness evaluation, open-set RFF identification with unknown-signal rejection, and cross-scenario spoofing detection. Experiments using a multi-scale attention convolutional neural network (MACNN) show that temporal robustness varies across configurations, with the best configuration achieving 97.75% average cross-day accuracy. In open-set evaluation, MACNN achieves an area under the receiver operating characteristic curve (AUROC) of 0.9715, while showing that effective unknown-signal rejection does not necessarily ensure reliable identity assignment. Cross-scenario experiments reveal differences at low false-positive rates. IriSig-Spoof provides a reproducible basis for evaluating robust RFF methods under temporal variation and changing attack conditions.

cs.CR

On a General Theoretical Framework for Radio Frequency Fingerprint-Based Authentication

While radio frequency fingerprint (RFF)-based wireless device authentication has been widely studied across different datasets and scenarios, there still lacks a fundamental theory to explain why and how RFF can serve as a reliable device identity, significantly hindering the practical application of such an authentication technology. In this article, we integrate the RFF modeling with authentication property analysis to propose a general theoretical framework to facilitate the development of such a theory. The RFF modeling process reveals how RFFs are induced, evolved and observed along the transmitter-channel-receiver chain, built upon which, the authentication property analysis process then outlines how the trustworthiness of an RFF should be examined in terms of its uniqueness, stability, distinguishability, and unforgeability. By linking the RFF formation/evolution to these authentication properties, the framework offers a solid foundation for understanding why and how RFF-based authentication is trustworthy in practice. We also discuss the communication-authentication co-design issue based on the theoretical insights from the proposed framework.

cs.CR

HoRFFI: High-Openness RF Fingerprint Identification with a Similarity-Enhanced Variational Information Bottleneck

Radio frequency fingerprint identification (RFFI) is a promising technique for wireless device authentication. However, practical RFFI systems must enroll newly authorized devices while rejecting previously unseen ones, even when the feature extractor is trained on only a few labeled base-device classes, giving rise to a high-openness RFFI problem. Existing open-set recognition methods typically rely on feature spaces learned from a large and diverse set of known-device classes, limiting their applicability in practical scenarios. To address this challenge, we propose HoRFFI, a high-openness RFFI framework that supports scalable device identification and unknown-device rejection using only a small number of labeled training devices. HoRFFI employs a similarity-enhanced variational information bottleneck (SVIB)-based supervision mechanism, which reduces the encoder's dependence on training-class diversity and learns a more transferable embedding space. This supervision mechanism uses feature-space augmentation and clustering to derive inter-sample similarity information, which provides supplementary supervision for regularizing the embedding space. Experiments on public LoRa and Wi-Fi datasets show that HoRFFI achieves absolute improvements of \(0.112\) and \(0.288\) in novel-class accuracy, respectively, and corresponding absolute AUC improvements of \(0.029\) and \(0.060\) over the best-performing baselines.

cs.CR

GalSAS-SDR-SIM: An End-to-End Simulation Platform for Galileo Signal Authentication Service

Galileo is developing a Signal Authentication Service (SAS) that integrates Open Service Navigation Message Authentication (OSNMA) on the E1 band with Spreading Code Authentication (SCA) on the E6 band to strengthen its resilience to spoofing attacks. As Galileo SAS is still under development, access to realistic and controllable SAS signals remains limited, hindering both the early development of compatible receivers and reproducible research on signal authentication. To bridge this gap, this paper presents GalSAS-SDR-SIM, an open-source software-defined radio (SDR) simulation platform that emulates the SAS workflow by coupling E6 code encryption with the OSNMA key-disclosure process. The platform allows flexible SAS configuration of code encryption parameters to accommodate receivers with different computational capabilities. It also supports the concurrent generation of Galileo E1, E5b, and E6 signals for user-defined locations and times, and OSNMA cross-satellite configurations. Experimental results demonstrate simultaneous verification of navigation messages and spreading codes. We further evaluate SAS authentication performance and computational resource costs under different SAS configurations. Implemented according to publicly available official specifications, GalSAS-SDR-SIM provides a practical tool for accelerating SAS-capable receiver development and supporting the research community in evaluating and improving Galileo signal-authentication techniques.

cs.CR

Practical Spoofing Attacks against Galileo OSNMA with Time-Synchronization Manipulation

Galileo launched the Open Service Navigation Message Authentication (OSNMA) to defend against spoofing attacks. This paper identifies an artificially manipulated time synchronization (ATS) condition in OSNMA-enabled receivers, under which attackers can jointly manipulate the Galileo signals and a receiver's local reference time (LRT) while still satisfying the time synchronization (TS) requirement. Exploiting the ATS condition, we propose a TS-compliant spoofing framework, including TS-compliant replay (TSR), TS-compliant forgery (TSF), and TS-compliant dual-frequency forgery (TSDF) attacks. The principle underlying these attacks is to first force the receiver to satisfy the TS requirement by manipulating its LRT, and then transmit carefully designed signals to spoof the receiver to the attacker-selected locations and times. More specifically, the TSR attack replays previously recorded E1 signals, the TSF attack transmits forged E1 signals containing valid OSNMA data, and the TSDF attack simultaneously forges both E1 and E5b signals, targeting dual-frequency receivers that support cross-band authentication. To validate the effectiveness of the proposed attacks, we conduct real-world experiments using two commercial Galileo receivers and two open-source software-defined radio (SDR) receivers that support OSNMA. The results showed that all attacks can successfully pass OSNMA authentication and spoof receivers to attacker-selected locations and times.

cs.CR

Covert Multicast in UAV-Enabled Wireless Communication Systems With One-hop and Two-hop Strategies

This paper delves into the time-efficient covert multicast in a wireless communication system facilitated by Unmanned Aerial Vehicle (UAV), in which the UAV aims to disseminate a common covert information to multiple ground users (GUs) while suffering from the risk of detection by a ground warden (Willie). We propose one hop (OH) and two hop (TH) transmission schemes, first develop a theoretical framework for performance modeling of both the detection error probability at Willie and the transmission time at UAV. The optimization problems subject to the covertness constraint for the two transmission schemes are then formulated to gain insights into the system settings of the UAV's prior transmit probability, transmit power and horizontal location that affect the minimum transmission time. The optimization problems are non-convex and challenging to give numerical results. We thus explore the optimal setting of the transmit power and the prior transmit probability for the UAV separately under specific parameters with two schemes. We further propose a particle swarm optimization (PSO) based algorithm and an exhaustive algorithm to provide the joint solutions for the optimization problem with the OH transmission scheme and TH scheme, respectively. Finally, the efficiency of the proposed PSO-based algorithm is substantiated through extensive numerical results.

cs.CR

Knowing What Not to Do: Leverage Language Model Insights for Action Space Pruning in Multi-agent Reinforcement Learning

Multi-agent reinforcement learning (MARL) is employed to develop autonomous agents that can learn to adopt cooperative or competitive strategies within complex environments. However, the linear increase in the number of agents leads to a combinatorial explosion of the action space, which may result in algorithmic instability, difficulty in convergence, or entrapment in local optima. While researchers have designed a variety of effective algorithms to compress the action space, these methods also introduce new challenges, such as the need for manually designed prior knowledge or reliance on the structure of the problem, which diminishes the applicability of these techniques. In this paper, we introduce Evolutionary action SPAce Reduction with Knowledge (eSpark), an exploration function generation framework driven by large language models (LLMs) to boost exploration and prune unnecessary actions in MARL. Using just a basic prompt that outlines the overall task and setting, eSpark is capable of generating exploration functions in a zero-shot manner, identifying and pruning redundant or irrelevant state-action pairs, and then achieving autonomous improvement from policy feedback. In reinforcement learning tasks involving inventory management and traffic light control encompassing a total of 15 scenarios, eSpark consistently outperforms the combined MARL algorithm in all scenarios, achieving an average performance gain of 34.4% and 9.9% in the two types of tasks respectively. Additionally, eSpark has proven to be capable of managing situations with a large number of agents, securing a 29.7% improvement in scalability challenges that featured over 500 agents. The code can be found in https://github.com/LiuZhihao2022/eSpark.git.

cs.MA

Dealing with Imbalanced Classes in Bot-IoT Dataset

With the rapidly spreading usage of Internet of Things (IoT) devices, a network intrusion detection system (NIDS) plays an important role in detecting and protecting various types of attacks in the IoT network. To evaluate the robustness of the NIDS in the IoT network, the existing work proposed a realistic botnet dataset in the IoT network (Bot-IoT dataset) and applied it to machine learning-based anomaly detection. This dataset contains imbalanced normal and attack packets because the number of normal packets is much smaller than that of attack ones. The nature of imbalanced data may make it difficult to identify the minority class correctly. In this thesis, to address the class imbalance problem in the Bot-IoT dataset, we propose a binary classification method with synthetic minority over-sampling techniques (SMOTE). The proposed classifier aims to detect attack packets and overcome the class imbalance problem using the SMOTE algorithm. Through numerical results, we demonstrate the proposed classifier's fundamental characteristics and the impact of imbalanced data on its performance.

cs.CR

Opportunistic Wiretapping/Jamming: A New Attack Model in Millimeter-Wave Wireless Networks

While the millimeter-wave (mmWave) communication is robust against the conventional wiretapping attack due to its short transmission range and directivity, this paper proposes a new opportunistic wiretapping and jamming (OWJ) attack model in mmWave wireless networks. With OWJ, an eavesdropper can opportunistically conduct wiretapping or jamming to initiate a more hazardous attack based on the instantaneous costs of wiretapping and jamming. We also provide three realizations of the OWJ attack, which are mainly determined by the cost models relevant to distance, path loss and received power, respectively. To understand the impact of the new attack on mmWave network security, we first develop novel approximation techniques to characterize the irregular distributions of wiretappers, jammers and interferers under three OWJ realizations. With the help of the results of node distributions, we then derive analytical expressions for the secrecy transmission capacity to depict the network security performance under OWJ. Finally, we provide extensive numerical results to illustrate the effect of OWJ and to demonstrate that the new attack can more significantly degrade the network security performance than the pure wiretapping or jamming attack.

cs.CR

Achieving Covertness and Secrecy: A New Paradigm for Secure Wireless Communication

This paper explores a new secure wireless communication paradigm where the physical layer security technology is applied to counteract both the detection and eavesdropping attacks, such that the critical covertness and secrecy properties of the communication are jointly guaranteed. We first provide theoretical modeling for covertness outage probability (COP), secrecy outage probability (SOP) and transmission probability (TP) to depict the covertness, secrecy and transmission performances of the paradigm. To understand the fundamental security performance under the new paradigm, we then define a new metric - covert secrecy rate (CSR), which characterizes the maximum transmission rate subject to the constraints of COP, SOP and TP. We further conduct detailed theoretical analysis to identify the CSR under various scenarios determined by the detector-eavesdropper relationships and the secure transmission schemes adopted by transmitters. Finally, numerical results are provided to illustrate the achievable performances under the new secure communication paradigm.

cs.IT

Combining IOTA and Attribute-Based Encryption for Access Control in the Internet of Things

Unauthorized resource access represents a typical security threat in the Internet of things (IoT), while distributed ledger technologies (e.g., blockchain and IOTA) hold great promise to address this threat. Although blockchain-based IoT access control schemes have been the most popular ones, they suffer from several significant limitations, such as high monetary cost and low throughput of processing access requests. To overcome these limitations, this paper proposes a novel IoT access control scheme by combining the fee-less IOTA technology and the Ciphertext-Policy Attribute-Based Encryption (CP-ABE) technology. To control the access to a resource, a token, which records access permissions to this resource, is encrypted by the CP-ABE technology and uploaded to the IOTA Tangle (i.e., the underlying database of IOTA). Any user can fetch the encrypted token from the Tangle, while only those who can decrypt this token are authorized to access the resource. In this way, the proposed scheme enables not only distributed, fee-less and scalable access control thanks to the IOTA but also fine-grained attribute-based access control thanks to the CP-ABE. We show the feasibility of our scheme by implementing a proof-of-concept prototype system and evaluate its performance in terms of access request processing throughput.

cs.CR

Attribute-Based Access Control for Smart Cities: A Smart Contract-Driven Framework

Efficient and reliable access control in smart cities is critical for the protection of various resources for decision making and task execution. Existing centralized access control schemes suffer from the limitations of single point of failure, low reliability and poor scalability. This paper therefore proposes a distributed and reliable access control framework for smart cities by combining the blockchain smart contract technology and the Attribute-Based Access Control (ABAC) model. The framework consists of one Policy Management Contract (PMC) for managing the ABAC policies, one Subject Attribute Management Contract (SAMC) for managing the attributes of subjects (i.e., entities accessing resources), one Object Attribute Management Contract (OAMC) for managing the attributes of objects (i.e., resources being accessed), and one Access Control Contract (ACC) for performing the access control. To show the feasibility of the proposed framework, we construct a local private Ethereum blockchain system to implement the four smart contracts and also conduct experiments to evaluate the monetary cost as well as to compare the proposed framework with an existing Access Control List (ACL)-based scheme. The experimental results show that although the proposed scheme consumes more money than the ACL-based scheme at the deployment stage, it introduces less monetary cost during the system running especially for large-scale smart cities.

cs.CR

Secure Millimeter-Wave Ad Hoc Communications Using Physical Layer Security

Millimeter-wave (mmWave) communications are highly promising to improve the capacity of modern wireless networks, while the physical layer security (PLS) techniques hold great potential to enhance the critical secrecy performance therein. By carefully exploiting the significant signal difference between the Non-Light-of-Sight (NLoS) and Line-of-Sight (LoS) mmWave links, this paper proposes a Sight-based Cooperative Jamming (SCJ) scheme to improve the PLS performance of mmWave ad hoc communications. In this scheme, each potential jammer that has no LoS link to its nearest receiver but may have LoS links to eavesdroppers is selected with a certain probability to generate artificial noise such that channel advantages at legitimate receivers can be achieved. For performance modeling of the new jamming scheme, novel and efficient theoretical approximation approaches are firstly developed to enable the challenging issue of interference distribution modeling to be tackled, and then a theoretical framework based on stochastic geometry is proposed to capture the secrecy transmission capacity behavior under the SCJ scheme. Finally, extensive numerical results are provided to illustrate the SCJ scheme under various network scenarios.

cs.IT

Smart Contract-Based Access Control for the Internet of Things

This paper investigates a critical access control issue in the Internet of Things (IoT). In particular, we propose a smart contract-based framework, which consists of multiple access control contracts (ACCs), one judge contract (JC) and one register contract (RC), to achieve distributed and trustworthy access control for IoT systems. Each ACC provides one access control method for a subject-object pair, and implements both static access right validation based on predefined policies and dynamic access right validation by checking the behavior of the subject. The JC implements a misbehavior-judging method to facilitate the dynamic validation of the ACCs by receiving misbehavior reports from the ACCs, judging the misbehavior and returning the corresponding penalty. The RC registers the information of the access control and misbehavior-judging methods as well as their smart contracts, and also provides functions (e.g., register, update and delete) to manage these methods. To demonstrate the application of the framework, we provide a case study in an IoT system with one desktop computer, one laptop and two Raspberry Pi single-board computers, where the ACCs, JC and RC are implemented based on the Ethereum smart contract platform to achieve the access control.

cs.CR

Mode Selection and Spectrum Partition for D2D Inband Communications: A Physical Layer Security Perspective

This paper investigates from the physical layer security (PLS) perspective the fundamental issues of mode selection and spectrum partition in cellular networks with inband device-to-device (D2D) communication. We consider a mode selection scheme allowing each D2D pair to probabilistically switch between the underlay and overlay modes, and also a spectrum partition scheme where the system spectrum is orthogonally partitioned between cellular and overlay D2D communications. We first develop a general theoretical framework to model both the secrecy outage/secrecy capacity performance of cellular users and outage/capacity performance of D2D pairs, and to conduct performance optimization to identify the optimal mode selection and spectrum partition for secrecy capacity maximization and secrecy outage probability minimization. A case study is then provided to demonstrate the application of our theoretical framework for performance modeling and optimization, and also to illustrate the impacts of mode selection and spectrum partition on the PLS performances of inband D2D communications.

cs.IT

Friendship-based Cooperative Jamming for Secure Communication in Poisson Networks

Wireless networks with the consideration of social relationships among network nodes are highly appealing for lots of important data communication services. Ensuring the security of such networks is of great importance to facilitate their applications in supporting future social-based services with strong security guarantee. This paper explores the physical layer security-based secure communication in a finite Poisson network with social friendships among nodes, for which a social friendship-based cooperative jamming scheme is proposed. The jamming scheme consists of a Local Friendship Circle (LFC) and a Long-range Friendship Annulus (LFA), where all legitimate nodes in the LFC serve as jammers, but the legitimate nodes in the LFA are selected as jammers through three location-based policies. To understand both the security and reliability performance of the proposed jamming scheme, we first model the sum interference at any location in the network by deriving its Laplace transform under two typical path loss scenarios. With the help of the interference Laplace transform results, we then derive the exact expression for the transmission outage probability (TOP) and determine both the upper and lower bounds on the secrecy outage probability (SOP), such that the overall outage performances of the proposed jamming scheme can be depicted. Finally, we present extensive numerical results to validate the theoretical analysis of TOP and SOP and also to illustrate the impacts of the friendship-based cooperative jamming on the network performances.

cs.IT